CVE-2026-46245: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46245 Overview

CVE-2026-46245 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU display driver (amdgpu). The flaw resides in the amdgpu_dm_hpd_init() function within amdgpu_dm_irq.c, which handles Hot Plug Detect (HPD) interrupt initialization. The function may encounter connectors without a valid dc_link pointer, and while existing code checks dc_link for polling decisions, it later unconditionally dereferences the same pointer when configuring HPD interrupts. This inconsistent handling can lead to a kernel NULL pointer dereference during display initialization.

Critical Impact
Triggering the NULL dereference in amdgpu_dm_hpd_init() causes a kernel oops, resulting in a denial of service on systems using AMD Display Core hardware.

Affected Products

Linux kernel versions containing the affected amdgpu_dm_irq.c HPD initialization code
Systems using the AMD Display Manager (amdgpu_dm) display driver
Hardware platforms relying on AMD Display Core (DC) for connector management

Discovery Timeline

2026-06-03 - CVE-2026-46245 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-46245

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the Linux kernel's AMD GPU display driver. The amdgpu_dm_hpd_init() function iterates through display connectors to register hot-plug detect interrupts. During this iteration, the code at line 928 correctly tests amdgpu_dm_connector->dc_link for NULL before calling dc_connector_supports_analog(). However, immediately after this guarded access, the code assigns dc_link = amdgpu_dm_connector->dc_link and then dereferences dc_link->irq_source_hpd at line 940 without any NULL check. Static analysis flagged this as an inconsistency: if the pointer was assumed potentially NULL on line 928, the unconditional dereference seven lines later represents a defect.

Root Cause

The root cause is inconsistent NULL pointer validation across a single function. The HPD initialization path treats dc_link as optionally NULL for the polling decision but treats the same field as guaranteed non-NULL for interrupt registration. Connectors enumerated by amdgpu_dm are not required to have an associated DC link, so the assumption breaks for non-standard or partially initialized connector entries.

Attack Vector

The defect is triggered during kernel-level display initialization on AMD hardware. An attacker would need a system configuration that produces a connector without a valid dc_link to invoke the dereference. Successful triggering crashes the kernel rather than yielding code execution. The upstream fix assigns dc_link early in the loop and skips any connector where dc_link is NULL, eliminating the unsafe path. See the kernel commit 226a40c0 and kernel commit a490e4d3 for the patch details.

Detection Methods for CVE-2026-46245

Indicators of Compromise

Kernel oops messages referencing amdgpu_dm_hpd_init in dmesg or journalctl -k output
NULL pointer dereference call traces involving amdgpu_dm_irq.c around line 940
Unexpected display subsystem failures or system hangs during boot on AMD GPU hosts

Detection Strategies

Inventory kernel versions across the fleet and compare against the patched stable branches referenced in the upstream commits
Monitor system logs for amdgpu driver faults and correlate with hardware configurations lacking a valid DC link
Use configuration management tooling to flag hosts running unpatched kernel builds with AMD display hardware

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: kernel NULL pointer dereference events tied to amdgpu
Track kernel crash reports through kdump or systemd-coredump to detect repeated failures during display initialization
Audit GPU driver versions during routine vulnerability scans, mapping results to the relevant stable kernel commits

How to Mitigate CVE-2026-46245

Immediate Actions Required

Apply the upstream Linux stable kernel patches that introduce the early dc_link assignment and NULL skip logic in amdgpu_dm_hpd_init()
Identify and prioritize servers, workstations, and embedded systems running AMD GPUs with affected kernel builds
Coordinate with distribution vendors to pull in backported fixes from the referenced stable trees

Patch Information

The fix is committed to the Linux kernel stable tree. The patch reorders the assignment of dc_link and adds a continue path for connectors where dc_link is NULL, preventing the dereference at line 940. Reference the upstream commits at git.kernel.org commit 226a40c0 and git.kernel.org commit a490e4d3.

Workarounds

Restrict physical and remote access to systems running unpatched kernels with AMD display hardware until updates are applied
Where feasible, defer enabling display hot-plug functionality on impacted hosts or use kernel command-line options to limit amdgpu initialization on headless servers
Schedule a kernel reboot window after patching to ensure the corrected amdgpu module is loaded

bash

# Verify the running kernel and amdgpu module after patching
uname -r
modinfo amdgpu | grep -E '^(version|srcversion|filename)'
dmesg | grep -i amdgpu